{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/windows-server-2025--25398/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*","cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*","cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2025-30397"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows Server 2025 (\u003c= 25398)","Windows 10 1507 (\u003c 10.0.10240.21014)","Windows 10 1607 (\u003c 10.0.14393.8066)","Windows 10 1809 (\u003c 10.0.17763.7314)","Windows 10 21h2 (\u003c 10.0.19044.5854)","Internet Explorer 11"],"_cs_severities":["high"],"_cs_tags":["cve-2025-30397","remote-code-execution","jscript","vulnerability","windows"],"_cs_type":"advisory","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eCVE-2025-30397 is a use-after-free vulnerability in the legacy JScript engine (jscript.dll) that allows for remote code execution. The vulnerability is triggered when a user is enticed to open a specially crafted HTML page using Internet Explorer 11. Publicly available proof-of-concept code demonstrates that attackers can use heap spraying techniques to gain stable memory corruption and execute arbitrary shellcode.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for remote code execution with the privileges of the logged-in user. The vulnerability is explicitly noted as enabling the execution of arbitrary payloads, such as calc.exe, in proof-of-concept demonstrations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify systems running Internet Explorer 11 and assess the necessity of its continued use.\u003c/li\u003e\n\u003cli\u003ePrioritize patching for the listed Windows versions as the public availability of exploit code increases the likelihood of exploitation.\u003c/li\u003e\n\u003cli\u003eDisable or restrict access to jscript.dll if business requirements permit, as it is a frequent target for memory corruption attacks.\u003c/li\u003e\n\u003cli\u003eMonitor for processes spawned by 'iexplore.exe' or the legacy JScript engine that deviate from standard browser operations.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T06:00:01Z","date_published":"2026-10-22T06:00:01Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-30397-jscript-rce/","summary":"A public exploit exists for a use-after-free vulnerability in the legacy JScript engine (jscript.dll) that allows remote code execution via Internet Explorer 11.","title":"Microsoft JScript Engine Use-After-Free Remote Code Execution (CVE-2025-30397)","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2025-30397-jscript-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Windows Server 2025 (\u003c= 25398)","version":"https://jsonfeed.org/version/1.1"}